Well technically, the username the user had was generated by us when we signed them up. I honestly think this issue probably would have presented for 1/10 users whose IDs happened to have a leading 0-digit. Our software couldn't handle a situation we had setup for it.

But yes, I do agree with the general sentiment of "communicate via something internal, not something user-supplied".